Even at their lowest rate in months, high-risk prompts hit 86% of GenAI-using organizations

The average user sent 106 prompts in August, up from 95 in July ^[1]. At August's flagged rate, that is about 2.5 data-exposure prompts per user for the month ^[1], or roughly 2,465 across a thousand seats ^[2]. In Healthcare and Medical, the highest-exposure sector, the same user accounts for about 4.2 ^[3], some 72% above the cross-industry figure ^[12].

A rate at a multi-month low ^[2] still leaves open whether exposure actually shrank. Per-user volume rose 11.6% between July and August ^[4], so the count of high-risk prompts per user fell only if the rate dropped by more than about 10% ^[5]. Check Point published August's rate and not July's ^[10], which leaves the product of rate and volume, the number a data-loss program actually cares about, unreconstructable from the release. The volume side is moving fast: 78 prompts per user in June against 106 in August is a 36% rise in two months ^[1][9].

That traffic is also split across tools. Check Point counts seven GenAI applications per organization on average and calls the spread a governance gap ^[12]. Its own framing puts the risk in what employees type rather than in whether the tool was sanctioned, and adds indirect prompt injection through externally sourced content to the same surface ^[13].

The rest of the board moved in one direction. The four-month attack series runs from 2,055 weekly attacks per organization in May to 2,422 in August ^[8], 367 more per week, an 18% climb ^[6]. August's 1,042 ransomware reports at 8% above July implies roughly 965 in July ^[7][7]. The phishing shift from 1 in 128 to 1 in 112 emails is about a 14% increase in the rate ^[6][8]. Education stayed the most-targeted sector at 5,354 weekly attacks, up 28% year over year ^[9]. The sharpest sector move was Hospitality, Travel and Recreation, up 56% to 3,056 and into third place ahead of Telecommunications ^[10]; Check Point attributes that to peak summer travel pressure, which the report offers as a suggestion rather than a finding ^[11]. Europe posted the highest regional growth at 28% ^[14].

The August figures come without a definition of a high-risk prompt, a sample size, or one incident traced to a leaked prompt ^[11]. The series trends consistently as month-over-month data from a single vendor's install base, but it offers no evidence of data actually lost, because the 86% figure counts organizations that produced flagged prompts ^[3], a population distinct from organizations that lost anything. A company wanting the number Check Point does not supply has to multiply its own monthly prompt volume by its own flag rate.